PT-2010-4259 · Microsoft · Windows Vista+5

Tarjei Mandt · Published 2010-10-13 · Updated 2023-12-07 · CVE-2010-2744

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Server 2003 version SP2 Microsoft Windows Vista versions SP1 through SP2 Microsoft Windows Server 2008 versions Gold through SP2 and R2 Microsoft Windows 7

Description The issue arises from the improper management of a window class by kernel-mode drivers, allowing local users to gain privileges. This can be achieved by creating a window and then modifying the popup menu structure using the SetWindowLongPtr function or using the SwitchWndProc function with a switch window information pointer that is not re-initialized when a WM NCCREATE message is processed. An elevation of privilege vulnerability exists due to the lack of proper validation of window class data by the Windows kernel-mode drivers, potentially allowing an attacker to run arbitrary code in kernel mode.

Recommendations For Microsoft Windows XP versions SP2 through SP3, update to a version that properly manages window classes. For Microsoft Windows Server 2003 version SP2, update to a version that properly validates window class data. For Microsoft Windows Vista versions SP1 through SP2, update to a version that correctly handles window class management. For Microsoft Windows Server 2008 versions Gold through SP2 and R2, update to a version that properly manages window classes. For Microsoft Windows 7, update to a version that properly validates window class data.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-2744

Affected Products

Windows

Windows 7

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

References · 9

• 🔥 https://exploit-db.com/exploits/15894 · Exploit
• 🔥 http://exploit-db.com/exploits/15894 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-073 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2744 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-2744 · Security Note
• http://us-cert.gov/cas/techalerts/TA10-285A.html · Note
• http://mista.nu/blog/2010/12/01/windows-class-handling-gone-wrong · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12085 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-073 · Note